{"id":"CVE-2026-66981","kind":"vulnerability","aliases":["CVE-2026-66981"],"related":[],"title":"HCL AION: trusted HTTP Host header lets attackers alter links and redirects","description":"HCL AION is affected by a vulnerability where the application trusted the value of the HTTP Host header supplied in requests without validation. An attacker could manipulate this header to influence links, redirects or responses generated by the application, potentially resulting in unintended behavior or security impact under certain conditions.","summary":"HCL AION trusts the HTTP Host header in requests without checking it. An attacker who sends a crafted Host header can influence links, redirects or responses the application generates.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hcl-aion","other"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-06T16:18:57+00:00","first_seen_at":"2026-11-06T16:42:42+00:00","triaged_at":"2026-11-06T16:44:39+00:00","updated_at":"2026-11-06T16:44:39+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-06T16:44:39Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"HCL AION: trusted HTTP Host header lets attackers alter links and redirects","impact":"medium","summary":"HCL AION trusts the HTTP Host header in requests without checking it. An attacker who sends a crafted Host header can influence links, redirects or responses the application generates.","audience":"businesses","category":"other","nicknames":[],"who_cares":["hcl-aion"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Links or redirects altered, possibly leading users to unintended destinations","analyst_note":"Find the affected and fixed AION versions and any required configuration in the HCL security bulletin for CVE-2026-66981; the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-66981 gave no version data.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"HCL AION deployments that generate links, redirects or responses from the request Host header. The sources do not say which AION versions are affected or which configurations are required. Teams not running HCL AION can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000646,"input_tokens":4219,"output_tokens":449,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-66981':15A,18A 'affect':54C 'aion':2A,21B,23B,52C 'alter':9A 'applic':49B,60C,89C 'attack':8A,35B,75C 'behavior':94C 'certain':99C 'check':32B 'condit':100C 'could':76C 'craft':39B 'cve':13A,16A 'generat':50B,86C 'hcl':1A,20B,22B,51C 'hcl-aion':19B 'header':6A,28B,41B,68C,79C 'host':5A,27B,40B,67C 'http':4A,26B,66C 'impact':97C 'influenc':43B,81C 'let':7A 'link':10A,44B,82C 'manipul':77C 'potenti':90C 'redirect':12A,45B,83C 'request':30B,71C 'respons':47B,85C 'result':91C 'secur':96C 'send':37B 'suppli':69C 'trust':3A,24B,61C 'unintend':93C 'valid':73C 'valu':63C 'vulner':57C 'without':31B,72C","nicknames":[],"mitigations":[],"who_affected":"HCL AION deployments that generate links, redirects or responses from the request Host header. The sources do not say which AION versions are affected or which configurations are required. Teams not running HCL AION can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["hclaion","medium","other"],"campaign_type":null,"search_a":"'-2026':14A,17A '-66981':15A,18A 'aion':2A 'alter':9A 'attack':8A 'cve':13A,16A 'hcl':1A 'header':6A 'host':5A 'http':4A 'let':7A 'link':10A 'redirect':12A 'trust':3A","search_b":"'aion':21B,23B 'applic':49B 'attack':35B 'check':32B 'craft':39B 'generat':50B 'hcl':20B,22B 'hcl-aion':19B 'header':28B,41B 'host':27B,40B 'http':26B 'influenc':43B 'link':44B 'redirect':45B 'request':30B 'respons':47B 'send':37B 'trust':24B 'without':31B","search_c":"'affect':54C 'aion':52C 'applic':60C,89C 'attack':75C 'behavior':94C 'certain':99C 'condit':100C 'could':76C 'generat':86C 'hcl':51C 'header':68C,79C 'host':67C 'http':66C 'impact':97C 'influenc':81C 'link':82C 'manipul':77C 'potenti':90C 'redirect':83C 'request':71C 'respons':85C 'result':91C 'secur':96C 'suppli':69C 'trust':61C 'unintend':93C 'valid':73C 'valu':63C 'vulner':57C 'without':72C","first_public_at":"2026-11-06T16:18:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"psirt@hcl.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-66981","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66981","severity":null,"published_at":"2026-11-06T16:18:57+00:00","modified_at":"2026-11-06T16:18:57+00:00","first_seen_at":"2026-11-06T16:42:42+00:00","fetched_at":"2026-11-06T16:42:42+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}